dimforge / dimforge/nalgebra

SIGSEGV/UB from safe code, Usize overflow allowing out of bounds wright

Open
#1,620 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
4.8k
Forks
565
PR merge metrics
No merged PRs in 30d

Description

Hi,

I am the Co-Lead of the Cargo Team and was recently hired by the Rust Foundation to help triage AI discovered bugs. This bug was found with AI, namely [scrutineer](https://github.com/alpha-omega-security/scrutineer) and gpt-5.6-sol. Except where specifically labeled this report was written by me.

This test panickes with `attempt to multiply with overflow` in debug, and `SIGSEGV: invalid memory reference` in release.

```rust
#[test]
fn wrapped_dimensions_allow_safe_out_of_bounds_write() {
let dimension = 1usize << 32;
let mut matrix = DMatrix::::from_vec(dimension, dimension, Vec::new());
matrix[(0, 0)] = 1;
}
```

This example can also be constructed with `serde_json::from_str`, `MatrixViewMut::from_slice_with_strides_generic`, `view_with_steps_mut`, `reshape_generic` in addition to `from_vec`. Because they all use the same check in `assert_view_index`. Which does not correctly check for overflow. Allowing safe code to synthesize an invalid pointer.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by running the `wrapped_dimensions_allow_safe_out_of_bounds_write` test and tracing `assert_view_index`. Compare the named construction paths: `from_vec`, `MatrixViewMut::from_slice_with_strides_generic`, `view_with_steps_mut`, `reshape_generic`, and `serde_json::from_str`. Done means the reproducer no longer permits an invalid access or release-mode memory fault.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.